The invention relates to a method of detecting an unauthorized exchange of components in a technical system, particularly a transport device, where the control unit sends an encoded message to a component to be checked, a randomly generated or not easily reproducible value being entered in a data field of the message, which is used for checking the installed component.
Such a method can, for example, be used in the case of motor vehicle radiators which provide a special catalytic method for converting harmful substances into environmentally compatible substances. In particular when a tax reduction is granted by the government, it is necessary to ensure that this special catalytic motor vehicle radiator had originally been installed in the transport device and will later also remain installed. A catalytic motor vehicle radiator to which the inventive method can be applied is known from German Patent Document DE 103 40 086 A1. However, the method of detecting an unauthorized exchange of components can also be used together with all other conceivable components in the case of a transport device or a machine tool.
It is an object of the present invention to further develop a method of detecting an unauthorized exchange of components such that an unauthorized exchange of components is made difficult. The method according to the invention is to be suitable particularly for an official authorization of tax-privileged systems in connection with environmental production measures by using special components.
Accordingly, the component accesses an assignment field and, as a result, assigns an identification to each random or not easily reproducible value transmitted with the message. The component transmits the identification corresponding to the value back to the control unit, so that, as a result of the identification, the control unit can decide whether the component is a component permitted to be used by this technical system.
In the case of the method according to the invention, a control unit sends a first message to the component to be checked and checks the message returning from the component as to whether the requested response is present. The exchange of messages has to take place in such a manner that malicious imitators cannot simply copy the message exchange process. It is therefore necessary for a value which is difficult to reproduce or is randomly generated to be sent with the message from the control unit. An assignment field is accessed in the component and an identification is assigned to the value. This identification is returned by the component to the control unit and can then be analyzed in the control unit. If, for example, an assignment field is filed in the control unit, which corresponds to the assignment field accessed by the component, the control unit, by using the not easily reproducible or random value, can access its own assignment field and, as a result, then has to receive the same identification as the one transmitted with the message by the component. The value can, for example, be generated in the control unit by means of a random event generator or, as a not easily reproducible value, can be created in that the control unit accesses a sensor signal which relates to, for example, the combustion chamber pressure, the rotational engine speed or rolling or pitching values of the vehicle. For example, when the control unit accesses the result value of a sensor, this result reflects a physical quantity which over the time has no easily representable, mathematical functional interrelationship. The control unit then reads in the sensor value, normalizes the latter, for example, to a value between 0 and 1, and then sends the value together with the message to the component. The returned identification can then be comprehended in the control unit in that an assignment field is compared within the control unit. On the other hand, it can also be provided that the component sends back a second encoded message to the control unit, in which case another identification contained therein, on the basis of a predetermined computation, will then again result in the value which is difficult to reproduce.
The assignment field preferably is a matrix, and the identification is determined on the basis of two values which are difficult to reproduce or of two randomly generated values which are transmitted with the message from the control unit to the sensor. The message from the control unit will then have two values, so that an unambiguous position can be determined within the matrix-shaped assignment field. The matrix is occupied with predetermined identifications in all positions, so that, by way of the two transmitted and random values, a different identification is obtained each time.
In a further development of the invention, a selection data field is provided within the message transmitted from the control unit to the component, for example, a sensor. The authorization check will then only be carried out by means of an access to the assignment field if a defined value is transmitted in the selection data field. If the defined value is not listed in the selection data field, the identification is generated not by way of the assignment field but, for example, by way of a mathematical algorithm. This mathematical algorithm is filed in the component and is implemented by using the two transmitted random values. This computation algorithm can be filed in the component as well as in the control unit. Thus, when the control unit inputs a certain value in the selection data field, the identification is generated on the basis of the matrix-type assignment field, but if the value deviates in the selection data field, the returned identification is generated by way of an algorithm which is then also present in the control unit for the checking.
As a result of this encoding system, a third party cannot determine mathematical interrelationships between the transmitted identifications by monitoring the bus messages, because the identifications cannot be mathematically determined by a linear exponential function or a power function. A decoding of the method is therefore extremely difficult, and it is almost impossible to log in an unauthorized component at the control unit.
In one embodiment, the process can take place as follows: At a cold start of the engine of a transport device, a message is sent at repeated time intervals by way of the databus to a temperature sensor, and two randomly defined values and a selection data field are provided in this message. An electronic circuit within the temperature sensor analyzes the message and, within a matrix-type assignment field, determines an identification on the basis of the two randomly determined values, if, for example, the value 39 or 79 is listed in the identification data field. At all other permissible values, an algorithm is used for computing the identification from the two randomly defined values. Then, the temperature sensor sends a message back to the control unit and transmits at least the identification and possibly also the selection data field.
In the simplest case, in the knowledge of the assignment field and of the algorithm and based on the known randomly defined values, it can be checked in the engine control unit whether the temperature sensor has an authorization for use in the transport device. If, for safety reasons, no matrix-type assignment field is filed within the control unit, the possibility exists that an additional message with another encoding is sent back by the temperature sensor, in which case the identification is then computed back by way of an algorithm in the control unit, so that the control unit then compares the identification of the first message with the computed-back identification from the second message. If the two identifications correspond to one another, the component, that is, the temperature sensor is authorized to be used for the particular transport device.
The computation of the identification is required to take place, for example, for the values 39 and 79 by way of an inverse matrix or an inverse function, and for the other values, relative to the selection data field, by way of an inverse function or a corresponding algorithm. If, in their results, the identifications of the first and the second message differ from one another, the permitted temperature sensor or the permitted component is not installed in the transport device and a fault signal is generated which can be indicated in the vehicle or can be recognized in the diagnostic system.
In a further development of the invention, on the basis of a function value or a function result sent back by the component by means of a message, a comparison is carried out in the control unit with the identification transmitted during a preceding message exchange and it is decided therefrom whether the component is that component which is permitted for the use in the transport device.
Different possibilities exist for further developing the teaching of the present invention in an advantageous manner.
Other objects, advantages and novel features of the present invention will become apparent from the following detailed description of the invention when considered in conjunction with the accompanying drawings.